AWS IoT Secure Tunneling MCP Server
AWS IoT Secure Tunneling is a managed service provided by Amazon Web Services (AWS) that enables secure, remote access to devices deployed in private or isolated networks without requiring inbound firewall rules or VPN connections.
Quick Start Summary
The AWS IoT Secure Tunneling MCP server is a Model Context Protocol bridge that connects AI assistants — including Claude Desktop, Cursor, Windsurf, and VS Code Copilot — to the AWS IoT Secure Tunneling API through natural language. It exposes 8 API endpoints as callable tools, such as CloseTunnel, DescribeTunnel, ListTagsForResource, and more. No authentication is required — setup takes approximately 30 seconds. The server uses STDIO transport and can be installed by running npx -y @mcp/amazonaws-com-iotsecuretunneling. This integration is sourced from the auto AWS IoT Secure Tunneling OpenAPI specification (v2018-10-05) and has a quality score of 46/99 (fair documentation coverage).
Server Details
- Category
- Cloud Infrastructure
- Authentication
- None
- Endpoints
- 8 operations
- Transport
- STDIO
- Spec Version
- v2018-10-05
- Install Command
npx -y @mcp/amazonaws-com-iotsecuretunneling
Environment Variables
AWS_IOT_SECURE_TUNNELING_API_KEYExample: your_aws_iot_secure_tunneling_api_key
Top Endpoints
/#X-Amz-Target=IoTSecuredTunneling.CloseTunnelCloseTunnel
/#X-Amz-Target=IoTSecuredTunneling.DescribeTunnelDescribeTunnel
/#X-Amz-Target=IoTSecuredTunneling.ListTagsForResourceListTagsForResource
/#X-Amz-Target=IoTSecuredTunneling.ListTunnelsListTunnels
/#X-Amz-Target=IoTSecuredTunneling.OpenTunnelOpenTunnel
One-Click Install
Copy the snippet for your MCP client and paste it in — zero editing required.
Claude Desktop
Add to claude_desktop_config.json
{
"mcpServers": {
"amazonaws-com-iotsecuretunneling": {
"command": "npx",
"args": [
"-y",
"@mcp/amazonaws-com-iotsecuretunneling"
],
"env": {
"AWS_IOT_SECURE_TUNNELING_API_KEY": "your_aws_iot_secure_tunneling_api_key"
}
}
}
}Cursor
Settings → MCP Servers → Add
{
"mcpServers": {
"amazonaws-com-iotsecuretunneling": {
"url": "https://mcpbridge.org/config/amazonaws-com-iotsecuretunneling.json"
}
}
}Saves as .cursor/mcp.json in the download. Move it to your project root.
VS Code
Use with MCP extension
{
"mcpServers": {
"amazonaws-com-iotsecuretunneling": {
"url": "https://mcpbridge.org/config/amazonaws-com-iotsecuretunneling.json"
}
}
}Endpoints Explorer
Search and browse the 8 operations supported by this server.
Multi-Language Code Examples
Executable code snippets for calling AWS IoT Secure Tunneling endpoints in curl, TypeScript, or Python.
curl -X POST "https://api.apis.guru/v2/specs/amazonaws.com/iotsecuretunneling/2018-10-05/#X-Amz-Target=IoTSecuredTunneling.CloseTunnel" \ -H "Content-Type: application/json" \ # No auth required
Manual Configuration
Directly add this block to your JSON config file, or use the hosted config registry URL.
{
"mcpServers": {
"amazonaws-com-iotsecuretunneling": {
"command": "npx",
"args": ["-y","@mcp/amazonaws-com-iotsecuretunneling"],
"env": {
"AWS_IOT_SECURE_TUNNELING_API_KEY": "your_aws_iot_secure_tunneling_api_key"
}
}
}
}Authentication Details
No authentication required. This MCP server runs out-of-the-box.
Documentation Links
Error Handling & HTTP Status Code Matrix
Common status codes, error causes, and resolution steps when invoking AWS IoT Secure Tunneling endpoints.
400 Bad RequestCause: Malformed payload parameters or missing required fields.
Resolution: Verify request schema in Endpoints tab before calling tool.
401 UnauthorizedCause: Missing or invalid API key credentials.
Resolution: Set environment variable in MCP client config under env object.
403 ForbiddenCause: Insufficient scope permissions for requested resource.
Resolution: Verify key permissions in developer dashboard.
404 Not FoundCause: Resource URL path or requested entity ID does not exist.
Resolution: Check path variables and parameters.
429 Rate Limit ExceededCause: API rate limit quota exceeded.
Resolution: Implement exponential backoff retry in tool call.
500 Internal ErrorCause: Upstream server runtime fault.
Resolution: Inspect STDIO stderr output for log trace.
Quality Score
Checked against our protocol-compliance rules.
Specification Version: v2018-10-05
Page compiled on: June 13, 2026
Own this API?
Verify ownership of this listing to control the description, configuration details, and documentation links. Choose between free manual verification or instant premium placement.
Option 1: Free Verification
Slow manual review. Requires creating a GitHub issue with verified documentation or domain verification.
- • Verified badge on page
- • Standard search sorting
- • 2-3 business days review
Option 2: Featured Upgrade($9/mo)
Instant verification plus premium styling, featured badges, and directory placement boost.
- • ★ Featured star & amber highlight border
- • Top of directory search placement
- • Instant activation via claim token
📖 Detailed MCP Integration Guide
A technical breakdown of capabilities, agent workflows, and security/configuration best practices.
device-001 in the us-east-1 region for a support session and tag it with 'ticket-ID-42'" would trigger the AI to invoke the OpenTunnel and TagResource endpoints sequentially, returning the connection endpoints to the developer. The agent can be asked to "List all currently active tunnels for devices in the factory-A fleet and close any that have been open for more than 4 hours" to enforce security policies, using ListTunnels for discovery and CloseTunnel for cleanup. Furthermore, it can automate credential hygiene by instructing it to "Rotate the access token for tunnel t-12345678 and notify the operations channel," executing the RotateTunnelAccessToken action to mitigate token leakage risks.AssumeRole with a tightly scoped IAM policy. Developers must adhere to the principle of least privilege, granting the AssumeRole permissions only to trusted identities and narrowly defining the Resource ARNs they can access. All tunnels should be time-bound, and the use of RotateTunnelAccessToken should be automated for long-lived sessions. It is also best practice to enable AWS CloudTrail logging for all API calls to maintain an audit trail and to use VPC endpoints or private connections for API access to avoid traversing the public internet. Configuration guidelines emphasize strict control over the destination device identities and the network interfaces the tunnel service can utilize.Similar APIs
Other APIs in the Cloud Infrastructure category.
Supabase API
Manage Supabase projects, databases, authentication, and storage through your AI agent.
API KeyCloudflare API
Manage Cloudflare DNS, CDN, Workers, and security settings through your AI agent.
API KeyVercel API
Deploy projects, manage domains, and monitor deployments through your AI agent.
Bearer TokenDigitalOcean API
The DigitalOcean API is a comprehensive, RESTful interface provided by DigitalOcean, a leading cloud infrastructure provider focused on simplifying cloud computing for developers, startups, and enterprises. It serves as the programmatic backbone for managing the entire DigitalOcean ecosystem, enabling users to provision, configure, and control cloud resources such as Droplets (virtual private servers), Kubernetes clusters, managed databases, networks, storage volumes, and application platforms. Core capabilities include full lifecycle management of these resources, from creation and scaling to monitoring and deletion, mirroring the functionality available in the DigitalOcean control panel. Its primary use cases range from automating infrastructure setup for CI/CD pipelines and enabling infrastructure-as-code practices to supporting dynamic application scaling and resource optimization for SaaS products, e-commerce sites, and development environments. The API is designed for both developers seeking to automate their cloud operations and businesses that require programmable, scalable cloud infrastructure without the complexity of larger hyperscale providers.
Related MCP Server Integrations
Supabase API MCP Setup
Manage Supabase projects, databases, authentication, and storage through your AI agent.
Cloudflare API MCP Setup
Manage Cloudflare DNS, CDN, Workers, and security settings through your AI agent.
Vercel API MCP Setup
Deploy projects, manage domains, and monitor deployments through your AI agent.
DigitalOcean API MCP Setup
The DigitalOcean API is a comprehensive, RESTful interface provided by DigitalOcean, a leading cloud infrastructure provider focused on simplifying cloud computing for developers, startups, and enterprises. It serves as the programmatic backbone for managing the entire DigitalOcean ecosystem, enabling users to provision, configure, and control cloud resources such as Droplets (virtual private servers), Kubernetes clusters, managed databases, networks, storage volumes, and application platforms. Core capabilities include full lifecycle management of these resources, from creation and scaling to monitoring and deletion, mirroring the functionality available in the DigitalOcean control panel. Its primary use cases range from automating infrastructure setup for CI/CD pipelines and enabling infrastructure-as-code practices to supporting dynamic application scaling and resource optimization for SaaS products, e-commerce sites, and development environments. The API is designed for both developers seeking to automate their cloud operations and businesses that require programmable, scalable cloud infrastructure without the complexity of larger hyperscale providers.
Access Analyzer MCP Setup
The AWS Identity and Access Management Access Analyzer API provides a powerful, policy-as-code service that automatically identifies resources accessible from outside your AWS account or organization. At its core, the service continuously evaluates resource-based policies—such as Amazon S3 bucket policies, AWS Identity and Access Management (IAM) roles, Amazon KMS key policies, and AWS Lambda function policies—using logic-based reasoning to determine which resources grant access to unknown external principals. Its primary use case is for security and compliance teams within enterprises to proactively detect unintended data exposure, enforce least privilege principles, and audit cross-account and cross-service access. The API endpoints allow programmatic control to create, configure, and query analyzers, manage archive rules for storing findings, and generate custom policy documents, making it a foundational tool for automating cloud security posture management at scale.